Skip to content

RadicalNotion.AI

We do not sell or share your personal information.

© 2026 RadicalNotion.AI

Security Data

CWE Directory
CAPEC Directory
CNA Directory
CNA Leaderboard
CNA Report Cards
Vendor Directory
Patched Functions
Data Sources

Calculators

CVSS Calculator
CVSS 4.0
CVSS 3.1
CVSS 3.0
CVSS 2.0
Badge Builder

Platform

My Vulnerabilities
Insights
Notifications
Pricing

Learn

Guides
What is a CVE?
What is CVSS?
The CISA KEV catalog
What is EPSS?

Company

About
Blog
Careers
Contact
Demo

Account

Sign up
Log in

Legal

Security
Privacy
Terms

RadicalNotion.AI

Security data

Weaknesses (CWE)The MITRE CWE weakness catalog
Attack Patterns (CAPEC)MITRE CAPEC attack patterns
CNAsNumbering authorities and report cards
VendorsVulnerabilities by vendor
Patched FunctionsWhere CVE fixes land in code

Tools

CVSS CalculatorScore CVSS 4.0, 3.1, 3.0 & 2.0
Badge BuilderEmbeddable SVG badges for READMEs

Resources

LearnSecurity guides
Data SourcesCVE data sources

About Blog Pricing Demo

Log in Create an account

Home
Patched Functions
Cesanta
Mongoose

cesanta/mongoose: Functions Patched by CVE Fixes

c

#209 of 500 repositories

cesanta/mongoose

Functions and files changed by CVE fixes in this repository.

Latest located fix October 14, 2026

24

CVE fixes located

Published CVEs

227

Functions patched

Distinct function sites

40

Files patched

Distinct source files

2017–2026

Years covered

By CVE publication date

Overview

24 published CVEs have a fix traced to functions in cesanta/mongoose, the earliest published in 2017. Those fixes changed 227 distinct functions across 40 files, in 2,022 patch hunks.

Among the 500 repositories tracked here, cesanta/mongoose ranks #209 by the number of CVEs with a located fix.

Most patched functions

Functions in cesanta/mongoose changed by the most CVE fixes.

1mg_http_parsemongoose.c11 CVEs · 4 patches2023 to 2026
2mg_http_parsesrc/http.c11 CVEs · 4 patches2023 to 2026
3mg_tls_verify_cert_signaturesrc/tls_builtin.c11 CVEs · 3 patches2026
4mg_tls_verify_cert_signaturemongoose.c11 CVEs · 3 patches2026
5mg_tls_recv_certsrc/tls_builtin.c10 CVEs · 2 patches2026
6gcm_finishsrc/tls_aes128.c10 CVEs · 2 patches2026
7http_cbsrc/http.c10 CVEs · 2 patches2026
8http_cbmongoose.c10 CVEs · 2 patches2026
9gcm_finishmongoose.c10 CVEs · 2 patches2026
10mg_tls_recv_certmongoose.c10 CVEs · 2 patches2026
11mg_aes_gcm_decryptmongoose.c10 CVEs · 2 patches2026
12ppp_handle_ipcpsrc/l2_ppp.c8 CVEs · 2 patches2026
13ppp_handle_ipcpmongoose.c8 CVEs · 2 patches2026
14mg_der_to_tlvmongoose.c8 CVEs · 2 patches2026
15mg_der_to_tlvsrc/tls_builtin.c8 CVEs · 2 patches2026

Most patched files

Files in cesanta/mongoose changed by the most CVE fixes.

1mongoose.c23 CVEs · 107 functions
2src/tls_builtin.c13 CVEs · 22 functions
3src/http.c12 CVEs · 11 functions
4src/net_builtin.c11 CVEs · 15 functions
5mongoose.h11 CVEs · 7 functions
6src/dns.c10 CVEs · 9 functions
7src/tls_aes128.c10 CVEs · 9 functions
8src/l2_ppp.c8 CVEs · 6 functions
9src/mqtt.c8 CVEs · 3 functions
10src/tls_openssl.c8 CVEs · 2 functions

Fix size

How much code a CVE fix in cesanta/mongoose changes, with backports counted once.

43

Median lines changed

Added plus removed, per CVE

46%

Fixes of 20 lines or fewer

Share of CVE fixes

4%

Fixes in a single function

Share of CVE fixes

Latest CVEs

The most recently published CVEs with a fix located in cesanta/mongoose, and the functions each fix changed.

Mongoose: ppp_handle_ipv6cp() uses attacker-controlled length without bounds check — OOB read and heap overflow (PPP/PPPoE, MG_ENABLE_IPV6)
CVE-2026-63626ppp_handle_ipcp ppp_handle_ipv6cp ppp_handle_lcp
High · CVSS 8.8
EPSS 0.2%2026-10-14
Mongoose: handle_opt() missing opts[1] > len check — 1-byte OOB read corrupts TCP MSS, silences mg_send() per connection
CVE-2026-73261handle_opt
High · CVSS 7.5
EPSS 0.3%2026-10-14
Mongoose: Out-of-bounds Read via length-counter underflow in built-in TLS X.509 DER parser
CVE-2026-73260mg_der_to_tlv
High · CVSS 7.5
EPSS 0.2%2026-10-14
Mongoose: Unauthenticated remote heap out-of-bounds read in built-in TLS: off-by-one length check in mg_tls_recv_record() underflows recv_len to SIZE_MAX
CVE-2026-73252mg_tls_recv_record
High · CVSS 7.5
EPSS 0.4%2026-10-14
Mongoose: TLS Hostname Verification Bypass via Overly Permissive Wildcard Matching
CVE-2026-73253mgf1_sha256 mg_der_parse mg_mqtt_next_prop
Critical · CVSS 9.1
EPSS 0.3%2026-08-20
Mongoose: Path traversal in SSI #include directives enables arbitrary file read
CVE-2026-73255mgf1_sha256 mg_der_parse mg_mqtt_next_prop
Medium · CVSS 6.5
EPSS 0.7%2026-08-20
Mongoose: Reflected XSS via decoded URI in directory listing render
CVE-2026-73259mgf1_sha256 mg_der_parse mg_mqtt_next_prop
Medium · CVSS 5.4
EPSS 0.4%2026-08-20
Mongoose: HTTP/1.0 detection off-by-one enables request smuggling via chunked TE
CVE-2026-73256mgf1_sha256 mg_der_parse mg_mqtt_next_prop
Critical · CVSS 9.1
EPSS 0.4%2026-08-20
Mongoose: Stored XSS via unescaped filenames in directory listing
CVE-2026-73254mgf1_sha256 mg_der_parse mg_mqtt_next_prop
Medium · CVSS 5.4
EPSS 0.3%2026-08-20
Mongoose: Multipart boundary/header scan logic error in mg_http_next_multipart
CVE-2026-73258mgf1_sha256 mg_der_parse mg_mqtt_next_prop
Medium · CVSS 6.5
EPSS 0.5%2026-08-20
Mongoose Built-in TLS: CA-bundle certificate chain accepted without any signature verification
CVE-2026-73251mg_tls_verify_cert_signature
Critical · CVSS 9.3
EPSS 0.2%2026-08-20
Mongoose: Content-Length + Transfer-Encoding coexistence enables request smuggling
CVE-2026-73257mgf1_sha256 mg_der_parse mg_mqtt_next_prop
Critical · CVSS 9.1
EPSS 0.7%2026-08-20

Get an alert for each new cesanta/mongoose CVE, with the patched functions and AI-written analysis.

Monitor mongoose CVEs

Other repositories

Repositories with a similar number of located CVE fixes.

admidio/admidio24 CVEs android.googlesource.com/platform-external-libavc24 CVEs Budibase/budibase24 CVEs coder/coder24 CVEs http4s/http4s24 CVEs OpenSC/OpenSC24 CVEs owncloud/core24 CVEs RocketChat/Rocket.Chat24 CVEs

Browse all repositories

Frequently asked questions

Common questions about CVE fixes in cesanta/mongoose.

How many CVEs have a located fix in cesanta/mongoose?: 24 published CVEs have a fix traced to functions in cesanta/mongoose, touching 227 functions across 40 files.
Which function in cesanta/mongoose has been patched by the most CVEs?: mg_http_parse in mongoose.c has been changed by 11 CVE fixes, from 2023 to 2026.
How large is a typical CVE fix in cesanta/mongoose?: The median fix changes 43 lines. 46% of fixes change 20 lines or fewer, and 4% change a single function.
How is a fix located to a function?: The upstream fix commit for each CVE is fetched and its diff is split into hunks. Each hunk is attributed to the function, method or type it changes, using the definition the diff itself names. Backports of the same fix to stable branches are counted once.

References

cesanta/mongoose on GitHub (opens in a new tab)
Patched functions directory
CWE directory: the weakness types behind these fixes

Fix locations are computed by RadicalNotion.AI from the upstream patch diff of each CVE. CVE data is sourced from the CVE Program.

Track cesanta/mongoose CVEs

Get an alert when a new CVE lands in this repository, with the patched functions and AI-written remediation guidance.

Create an account See pricing

On this page

Overview
Most patched functions
Most patched files
Fix size
Latest CVEs
Other repositories
FAQ
References